ASD ISM 1980 Avoid using credential hints in systems
What it says
Credential hint functionality is not used for systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystems should not use hints to reveal or guess passwords.
You should avoid using hints that help people remember passwords because they can make it easier for bad actors to guess them. If someone figures out your password, they could access your organisation's sensitive information and cause harm, such as stealing data or disrupting operations.
Free. Save your status, tasks and notes.
Why it matters
Credential hints increase the likelihood of unauthorised access by simplifying password guessing, risking data breaches and financial loss.
How to implement
System owners should review all login processes to identify where credential hints are used.
List any instances where hints might display or send a clue about passwords to users. This helps ensure that no password hints are made available.
IT teams should modify software and systems to disable password hint features.
Check each system's settings or configurations and switch off any options that provide hints. This will ensure that no hints are accidentally shown to users.
Managers should educate staff on the importance of using strong, unique passwords without relying on hints.
Organise training sessions explaining the risks of weak passwords and the benefit of using a password manager instead.
Human Resources should update any employee handbooks or guidelines to include policies against using credential hints.
Clearly document why hints aren't used and describe the procedures to follow if help with credentials is needed.
System administrators should implement measures to support users in resetting forgotten passwords easily and securely without needing hints.
Ensure there is a clear password reset process, such as using email verification or mobile authentication, to confirm the user's identity before allowing a password change.
Keep it running
Regularly review authentication systems to ensure they're free from hint mechanisms that could aid attackers in guessing credentials.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
System configuration logs: Request documentation or screenshots showing the system settings related to password management.
Look at
Options or settings that relate to 'credential hints' being turned off.
Good evidence
Shows clear evidence that credential hints are disabled across all systems.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request materials and attendance logs from staff training sessions about password security.
Look at
Evidence that staff were informed about the risks of credential hints.
Good evidence
Includes dated training materials and a list of attendees.
- Check 3 of 5What an auditor asks for
Ask for
Policy updates: Request the latest employee handbook or IT policy documents.
Look at
Sections that clearly state no credential hints should be used and explain alternative password support methods.
Good evidence
Shows these policies are up to date and communicated to all staff.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of a password reset process: Request the documentation or walkthrough of the current password reset process for users.
Look at
Secure methods like identity verification steps without using hints.
Good evidence
Is a detailed description showing how users can reset passwords securely.
- Check 5 of 5What an auditor asks for
Ask for
A demonstration: Request a live or recorded demonstration of the login and password reset process.
Look at
Indications there is no password hint feature during login or password recovery.
Good evidence
Shows the process step-by-step with explanations of each phase.
Mappings
Closest match in ISO/IEC 27001: A.5.17, Management of authentication information, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.17.
ISM-1980 requires that credential hint functionality is not used for systems, since hints can disclose or help guess authentication information. This is a specific rule for protecting authentication information within the management process required by Annex A 5.17. Annex A 5.17 covers allocation, resetting and user handling of all authentication information, while ISM-1980 prohibits one feature.
This control partially meets A.8.5.
ISM-1980 requires that credential hint functionality is not used for systems. Avoiding log-on aids that could help an unauthorised user is part of implementing secure authentication technologies and procedures under Annex A 8.5. Annex A 8.5 covers the full design of secure authentication, whereas ISM-1980 removes one insecure feature.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.